Skip to content

Commit bbf2406

Browse files
sabarish244sabarish244
committed
TO match current config - Refactor secrets-store-provider module: remove unused variables, update README, and add Helm chart templates
1 parent ba023eb commit bbf2406

File tree

13 files changed

+286
-44
lines changed

13 files changed

+286
-44
lines changed

‎aws/platform/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ locals {
393393
]
394394
image = {
395395
repository = "public.ecr.aws/aws-observability/aws-for-fluent-bit"
396-
tag = "2.31.6"
396+
tag = "2.22.0"
397397
}
398398
resources = {
399399
limits = {

‎aws/platform/modules/secrets-store-provider/README.md‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,7 @@
2222

2323
| Name | Description | Type | Default | Required |
2424
|------|-------------|------|---------|:--------:|
25-
| <a name="input_chart_name"></a> [chart\_name](#input\_chart\_name) | Helm chart to install | `string` | `null` | no |
26-
| <a name="input_chart_repository"></a> [chart\_repository](#input\_chart\_repository) | Helm repository containing the chart | `string` | `null` | no |
2725
| <a name="input_chart_values"></a> [chart\_values](#input\_chart\_values) | Overrides to pass to the Helm chart | `list(string)` | `[]` | no |
28-
| <a name="input_chart_version"></a> [chart\_version](#input\_chart\_version) | Version of chart to be installed | `string` | `null` | no |
29-
| <a name="input_k8s_namespace"></a> [k8s\_namespace](#input\_k8s\_namespace) | Kubernetes namespace in which the chart should be installed | `string` | `"kube-system"` | no |
30-
| <a name="input_name"></a> [name](#input\_name) | Name of this Helm release | `string` | `"csi-secrets-store-provider-aws"` | no |
26+
| <a name="input_k8s_namespace"></a> [k8s\_namespace](#input\_k8s\_namespace) | Kubernetes namespace in which resources will be written | `string` | `"kube-system"` | no |
27+
| <a name="input_name"></a> [name](#input\_name) | Name for the Helm release | `string` | `"csi-secrets-store-provider-aws"` | no |
3128
<!-- END_TF_DOCS -->

‎aws/platform/modules/secrets-store-provider/chart.json‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎aws/platform/modules/secrets-store-provider/chart/Chart.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Based on the installation manifests from AWS:
2+
# https://github.com/aws/secrets-store-csi-driver-provider-aws/blob/main/deployment/aws-provider-installer.yaml
3+
4+
apiVersion: v2
5+
name: csi-secrets-store-provider-aws
6+
description: AWS CSI secrets store provider
7+
8+
type: application
9+
10+
version: 0.1.1
11+
12+
appVersion: 1.0.r2-2021.08.13.20.34-linux-amd64

‎aws/platform/modules/secrets-store-provider/chart/templates/_helpers.tpl‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "ascp.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
7+
{{- end }}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "ascp.fullname" -}}
15+
{{- if .Values.fullnameOverride }}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
17+
{{- else }}
18+
{{- $name := default .Chart.Name .Values.nameOverride }}
19+
{{- if contains $name .Release.Name }}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
21+
{{- else }}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
23+
{{- end }}
24+
{{- end }}
25+
{{- end }}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "ascp.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "ascp.labels" -}}
38+
helm.sh/chart: {{ include "ascp.chart" . }}
39+
{{ include "ascp.selectorLabels" . }}
40+
{{- if .Chart.AppVersion }}
41+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
42+
{{- end }}
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- end }}
45+
46+
{{/*
47+
Selector labels
48+
*/}}
49+
{{- define "ascp.selectorLabels" -}}
50+
app.kubernetes.io/name: {{ include "ascp.name" . }}
51+
app.kubernetes.io/instance: {{ .Release.Name }}
52+
{{- end }}
53+
54+
{{/*
55+
Create the name of the service account to use
56+
*/}}
57+
{{- define "ascp.serviceAccountName" -}}
58+
{{- if .Values.serviceAccount.create }}
59+
{{- default (include "ascp.fullname" .) .Values.serviceAccount.name }}
60+
{{- else }}
61+
{{- default "default" .Values.serviceAccount.name }}
62+
{{- end }}
63+
{{- end }}

‎aws/platform/modules/secrets-store-provider/chart/templates/clusterrole.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{{- if .Values.rbac.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRole
4+
metadata:
5+
name: {{ include "ascp.fullname" . }}
6+
labels:
7+
{{- include "ascp.labels" . | nindent 4 }}
8+
rules:
9+
- apiGroups: [""]
10+
resources: ["serviceaccounts/token"]
11+
verbs: ["create"]
12+
- apiGroups: [""]
13+
resources: ["serviceaccounts"]
14+
verbs: ["get"]
15+
- apiGroups: [""]
16+
resources: ["pods"]
17+
verbs: ["get"]
18+
- apiGroups: [""]
19+
resources: ["nodes"]
20+
verbs: ["get"]
21+
{{- end }}

‎aws/platform/modules/secrets-store-provider/chart/templates/clusterrolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{{- if .Values.rbac.enabled -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: ClusterRoleBinding
4+
metadata:
5+
name: {{ include "ascp.fullname" . }}
6+
labels:
7+
{{- include "ascp.labels" . | nindent 4 }}
8+
roleRef:
9+
apiGroup: rbac.authorization.k8s.io
10+
kind: ClusterRole
11+
name: {{ include "ascp.fullname" . }}
12+
subjects:
13+
- kind: ServiceAccount
14+
name: {{ include "ascp.serviceAccountName" . }}
15+
namespace: {{ .Release.Namespace }}
16+
{{- end }}

‎aws/platform/modules/secrets-store-provider/chart/templates/daemonset.yaml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: {{ include "ascp.fullname" . }}
5+
labels:
6+
{{- include "ascp.labels" . | nindent 4 }}
7+
spec:
8+
updateStrategy:
9+
type: RollingUpdate
10+
selector:
11+
matchLabels:
12+
{{- include "ascp.selectorLabels" . | nindent 6 }}
13+
template:
14+
metadata:
15+
{{- with .Values.daemonset.podAnnotations }}
16+
annotations:
17+
{{- toYaml . | nindent 8 }}
18+
{{- end }}
19+
labels:
20+
{{- include "ascp.selectorLabels" . | nindent 8 }}
21+
{{- with .Values.daemonset.podLabels }}
22+
{{- toYaml . | nindent 8 }}
23+
{{- end }}
24+
spec:
25+
{{- with .Values.daemonset.imagePullSecrets }}
26+
imagePullSecrets:
27+
{{- toYaml . | nindent 8 }}
28+
{{- end }}
29+
{{- with .Values.daemonset.podSecurityContext }}
30+
securityContext:
31+
{{- toYaml . | nindent 8 }}
32+
{{- end }}
33+
serviceAccountName: {{ include "ascp.serviceAccountName" . }}
34+
hostNetwork: true
35+
containers:
36+
- name: provider-aws-installer
37+
{{- with .Values.daemonset.podSecurityContext }}
38+
securityContext:
39+
{{- toYaml . | nindent 12 }}
40+
{{- end }}
41+
image: "{{ .Values.daemonset.image.repository }}:{{ .Values.daemonset.image.tag | default .Chart.AppVersion }}"
42+
imagePullPolicy: {{ .Values.daemonset.image.pullPolicy }}
43+
args:
44+
- --provider-volume=/etc/kubernetes/secrets-store-csi-providers
45+
resources:
46+
{{- toYaml .Values.daemonset.resources | nindent 10 }}
47+
{{- with .Values.daemonset.env }}
48+
env:
49+
{{- toYaml . | nindent 10 }}
50+
{{- end }}
51+
{{- with .Values.daemonset.envFrom }}
52+
envFrom:
53+
{{- toYaml . | nindent 10 }}
54+
{{- end }}
55+
volumeMounts:
56+
- mountPath: "/etc/kubernetes/secrets-store-csi-providers"
57+
name: providervol
58+
- name: mountpoint-dir
59+
mountPath: /var/lib/kubelet/pods
60+
mountPropagation: HostToContainer
61+
volumes:
62+
- name: providervol
63+
hostPath:
64+
path: "/etc/kubernetes/secrets-store-csi-providers"
65+
- name: mountpoint-dir
66+
hostPath:
67+
path: /var/lib/kubelet/pods
68+
type: DirectoryOrCreate
69+
{{- with .Values.daemonset.nodeSelector }}
70+
nodeSelector:
71+
{{- toYaml . | nindent 8 }}
72+
{{- end }}
73+
{{- with .Values.daemonset.priorityClassName }}
74+
priorityClassName: {{ . }}
75+
{{- end }}
76+
{{- with .Values.daemonset.affinity }}
77+
affinity:
78+
{{- toYaml . | nindent 8 }}
79+
{{- end }}
80+
{{- with .Values.daemonset.tolerations }}
81+
tolerations:
82+
{{- toYaml . | nindent 8 }}
83+
{{- end }}

‎aws/platform/modules/secrets-store-provider/chart/templates/serviceaccount.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "ascp.serviceAccountName" . }}
6+
labels:
7+
{{- include "ascp.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

‎aws/platform/modules/secrets-store-provider/chart/values.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# Default values for ASCP.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
nameOverride: ""
6+
fullnameOverride: ""
7+
8+
daemonset:
9+
image:
10+
repository: public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws
11+
pullPolicy: IfNotPresent
12+
# Overrides the image tag whose default is the chart appVersion.
13+
tag: ""
14+
15+
imagePullSecrets: []
16+
17+
podAnnotations: {}
18+
19+
podSecurityContext: {}
20+
# fsGroup: 2000
21+
22+
securityContext: {}
23+
# capabilities:
24+
# drop:
25+
# - ALL
26+
# readOnlyRootFilesystem: true
27+
# runAsNonRoot: true
28+
# runAsUser: 1000
29+
30+
resources:
31+
requests:
32+
cpu: 50m
33+
memory: 100Mi
34+
limits:
35+
memory: 100Mi
36+
37+
nodeSelector:
38+
kubernetes.io/os: linux
39+
40+
tolerations: []
41+
42+
affinity: {}
43+
44+
# Pods will be unable to access secrets without this pod running
45+
priorityClassName: system-node-critical
46+
47+
# Environment variables can be referenced from config using dollar syntax
48+
# envFrom:
49+
# - secretRef:
50+
# name: oauth-secret
51+
52+
service:
53+
type: ClusterIP
54+
port: 5556
55+
56+
serviceAccount:
57+
# Specifies whether a service account should be created
58+
create: true
59+
# Annotations to add to the service account
60+
annotations: {}
61+
# The name of the service account to use.
62+
# If not set and create is true, a name is generated using the fullname template
63+
name: ""
64+
65+
# Whether Role Based Access Control objects like roles and rolebindings should be created
66+
rbac:
67+
enabled: true

0 commit comments

Comments
 (0)